{
 "id": "WPSEC-2026-2710",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2710/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2710/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2710/index.md",
 "title": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Unauthenticated Payment Bypass via PayPal Order Completion",
 "description": "The User Registration & Membership plugin for WordPress is vulnerable to payment verification bypass via the PayPal (REST) checkout webhook in all versions up to, and including, 5.3.1. This is due to the webhook handler completing the member's latest order and activating the subscription on a CHECKOUT.ORDER.APPROVED event, which PayPal sends before any payment is captured, without checking the captured amount or currency. The redirect and webhook handlers also matched the member's most recent order instead of the order the checkout was created for. This makes it possible for unauthenticated attackers who register through a paid membership form to have the membership activated without paying, by approving the PayPal order and never returning to the site.",
 "plugin": {
  "slug": "user-registration",
  "name": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder",
  "full_name": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder",
  "wordpress_org": "https://wordpress.org/plugins/user-registration/",
  "advisories_url": "https://wpsec.com/vuln/plugin/user-registration/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/user-registration"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.2",
 "remediation": "Update to 5.3.2 or later.",
 "fix_released": "2026-11-06T11:46:22+00:00",
 "published": "2026-11-07T12:41:15+00:00",
 "updated": "2026-11-07T11:11:19.674580+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2710/",
  "https://plugins.svn.wordpress.org/user-registration/tags/5.3.2/",
  "https://wordpress.org/plugins/user-registration/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/user-registration",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-07"
 }
}